Navicat for Oracle 12.1.15 contains a denial of service flaw that permits a local attacker to crash the graphical client by submitting an excessively long password string while configuring an Oracle connection. The vulnerability results from insufficient input validation when processing the password field, allowing an attacker to supply a buffer of 550 repeated characters that triggers an application crash. The impact is a temporary loss of service for users of the client, potentially disrupting database administration tasks.

The flaw impacts Navicat for Oracle, specifically version 12.1.15. Users employing this edition of the database client are susceptible to the described denial of service when they have local access to the machine.

The vulnerability scores a CVSS base of 6.9, indicating a moderate severity. Its exploitability is limited to local users with the ability to enter configuration data for Oracle connections; no remote attack vector is documented. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting it is not a widely exploited or actively used vulnerability. An attacker can trigger the crash by simply entering a 550-character repeated string in the password field during a standard connection setup.